To comply with the EU Deforestation Regulation (EUDR), a business that places cattle, cocoa, coffee, oil palm, rubber, soy, wood, or any product derived from them on the EU market — or exports such goods from it — must prove the goods were not produced on land deforested after December 31, 2020, run a three-step due diligence process, file an electronic statement with plot-level geolocation, and keep the records for five years.1EUR-Lex. Regulation 2023/1115 – EN Large and medium-sized operators must be ready by December 30, 2026; micro and small operators have until June 30, 2027.2European Commission. Delay Until December 2026 and Other Developments in the Implementation of EUDR Regulation What follows is what each of those obligations actually looks like in practice, and what happens if you miss them.
Which Products Fall Under the Rules
Seven commodity groups are in scope: cattle, cocoa, coffee, oil palm, rubber, soy, and wood.3European Commission. Regulation on Deforestation-free Products The regulation reaches well past raw materials into derived goods such as leather, chocolate, tires, printed paper, wooden furniture, and palm-oil-based chemicals. Whether a specific product is covered turns on its eight-digit Harmonized System (HS) code and whether that code appears in Annex I of the adopted text.
The practical consequence: a business importing something as ordinary as a cardboard box or a rubber gasket needs to check the HS code before assuming the rules do not apply. Enforcement agencies check the HS code first, and a listed code with no due diligence statement behind it is how shipments get held at customs.
Who Has to Comply
The regulation splits obligations between upstream operators and everyone downstream. An operator is the business that first places a covered product on the EU market or exports it as part of a commercial activity, and that role carries the heaviest load: running full due diligence, filing statements in the EU Information System, and passing the resulting reference number to the direct buyer.4European Commission. Understand Roles and Responsibilities Under the EUDR
Downstream operators and traders come next in the chain. A downstream operator processes the product into another Annex I product, changing its HS code; a trader resells without changing the code. Neither group runs its own due diligence or files new statements. Both must, however, keep records of suppliers and buyers for at least five years and notify authorities if they suspect a product is non-compliant. Large downstream operators and traders additionally have to register in the Information System and verify that upstream due diligence was completed and returned a negligible-risk finding, but only when they have reason to believe a product might not comply.4European Commission. Understand Roles and Responsibilities Under the EUDR
Micro and small downstream operators and traders get a lighter regime. They do not register in the Information System and do not verify upstream due diligence at all. Their duties are limited to collecting and retaining supplier and buyer information for five years and reporting suspected non-compliance. The first downstream buyer of a product from an upstream operator has to hold on to the due diligence statement reference number but is not obliged to pass it further along the chain.
The Three-Step Due Diligence Process
Upstream operators have to complete a structured process before any covered product moves. If they cannot reach a negligible-risk conclusion at the end, the product cannot legally be placed on the market or exported.5European Commission. Understand Due Diligence
Step one is information collection. Article 9 requires the product description, quantity, country of production, geolocation coordinates of every plot involved, the date or range of production, supplier and buyer details, and evidence the product is both deforestation-free and legally produced.1EUR-Lex. Regulation 2023/1115 – EN
Step two is risk assessment. The operator weighs the collected data against factors like the prevalence of deforestation in the source country, whether indigenous peoples’ rights are affected, the complexity of the supply chain, and how strong local law enforcement is. Anything more than negligible risk blocks the next stage.
Step three is risk mitigation. Where risk is identified, the operator has to take proportionate measures to bring it down to a negligible level. Only then can the product legally move.
Geolocation and the Data Package
Geolocation is the most technically demanding requirement. Every plot of land where a covered commodity was produced has to be mapped with latitude and longitude accurate to six decimal digits. Plots larger than four hectares need a full polygon outline of the perimeter. Plots of four hectares or smaller can be identified with a single coordinate point, though auditors increasingly prefer polygons and they may eventually be required.6European External Action Service. Frequently Asked Questions – EUDR
For commodities like cocoa or coffee that come from dozens or hundreds of smallholder farms aggregated into a single shipment, every individual farm plot has to be geolocated. There is no aggregation exception. This is the step that catches the most businesses off guard, because building geolocation records across fragmented supply chains in regions with limited digital infrastructure takes months of fieldwork.
Coordinates alone are not enough. Operators also have to document the exact date or time range of production, giving authorities a timeline that proves the goods were not harvested from land deforested after December 31, 2020. The data package must include evidence of compliance with local laws in the country of production, covering land use rights, environmental protections, and labor rules.1EUR-Lex. Regulation 2023/1115 – EN The full record has to be kept for at least five years from the date the product enters or leaves the EU.
Filing the Due Diligence Statement
Once the three-step process is complete and risk is judged negligible, the operator submits a due diligence statement through the EU’s Information System, hosted on the TRACES NT platform.7European Commission. The Information System of the Deforestation Regulation Registering requires a valid Economic Operators Registration and Identification (EORI) number issued by an EU member state.
The statement is an electronic form filed before the product is placed on the market. On successful submission, the system generates a unique reference number that acts as the product’s compliance passport, and the operator passes that number to its direct downstream buyer. That first buyer keeps the reference for five years and is not required to pass it further down.4European Commission. Understand Roles and Responsibilities Under the EUDR
Member state competent authorities monitor filings and can verify claims through satellite imagery, automated risk screening, or physical audits. Discrepancies between geolocation data and satellite observations give authorities grounds to pause the movement of the goods until the issue is cleared up.
How Country Risk Changes the Workload
The EU sorts every producing country into one of three risk tiers, and the tier affects both the compliance steps required and the frequency of government checks.8European Commission. Country Classification List
Sourcing from a low-risk country still requires collecting all information under Article 9, but operators can skip the risk assessment and mitigation steps. Authorities check 1% of shipments from these countries.9European Commission. EUDR Cooperation and Partnerships Standard-risk sourcing triggers the full three-step process, and authorities check 3% of shipments. High-risk sourcing means full due diligence with heightened scrutiny and 9% shipment checks. Belarus, the Democratic People’s Republic of Korea, Myanmar, and Russia were designated high-risk under the initial classification.8European Commission. Country Classification List
Major commodity origins including Brazil, Indonesia, Colombia, and Malaysia are classified as standard risk. Most EU member states, along with the United States, Canada, Australia, Japan, and China, fall into the low-risk tier. The Commission plans to review the classifications periodically based on new deforestation data.
Deadlines and the Transitional Stock Problem
The regulation was originally set to apply in late 2024, but the European Parliament approved a 12-month delay. Under Regulation (EU) 2025/2650, large and medium-sized operators, all downstream operators and traders regardless of size, and micro and small enterprises dealing in products previously covered by the EU Timber Regulation must comply by December 30, 2026. Natural-person operators and micro-enterprise operators dealing in the remaining EUDR products have until June 30, 2027.2European Commission. Delay Until December 2026 and Other Developments in the Implementation of EUDR Regulation
Existing stock creates a practical problem. Wood and wood products harvested before June 29, 2023, may remain subject to the older EU Timber Regulation (EUTR) rather than the EUDR and do not require a due diligence statement. Products harvested after December 30, 2025, fall squarely under the EUDR. The gray zone in between requires documentation such as bills of lading and customs declarations to prove which regime applies to each batch, and invoices and delivery notes should clearly distinguish EUTR stock from EUDR stock.
Penalties for Non-Compliance
Each member state runs its own enforcement, but the regulation sets minimum penalty standards every state has to meet.1EUR-Lex. Regulation 2023/1115 – EN For legal entities, the maximum fine has to be at least 4% of total annual EU-wide turnover for the preceding financial year, and fines must be calculated to strip any economic benefit the offender gained. Repeat violations push the numbers higher.
Authorities can also seize the specific non-compliant products and any revenue earned from selling them. Companies can be temporarily barred from public procurement, grants, and concessions for up to 12 months. Serious or repeated violations can trigger a temporary ban on placing or exporting covered products at all, and repeat offenders can lose eligibility for the simplified low-risk-country process. The Commission publishes the names of companies found in violation through final judgments, along with a summary of the offense and the penalty amount.
Deforestation Is Not the Only Test
One trap worth flagging: keeping tree cover on a plot is not the same as staying compliant. The regulation covers both deforestation, meaning conversion of forested land to non-forest use, and forest degradation, which includes converting primary or naturally regenerating forests into plantation forests or other wooded land, and converting primary forests into planted forests.1EUR-Lex. Regulation 2023/1115 – EN A primary forest replaced by rows of oil palm counts as degradation even though the land is technically still tree-covered. Wood products carry an added condition: the wood itself has to have been harvested without inducing degradation, not merely produced on land that was deforestation-free.